Conficker Stirs, updates and installs payload

Might go to sleep on May 3rd.

Published Thu, Apr 9 2009 10:31 AM CDT   |   Updated Tue, Nov 3 2020 12:37 PM CST
Conficker, the bug that failed to impress anyone on April 1st has been seen to stir.

According to TrendMicro Conficker updated itself through P2P and dropped a payload similar to a keylogger on all of the systems infected. At the same time it appeared that the software was checking internet connectivity by hitting sites like MSN, MySpace and a couple of others.

To make matters more interesting it seems that Conficker may shut down on May 3rd. This is not confirmed and even if it is true the Worm could be reactivated at any time.

One more item of concern is that Conficker appears to talk to the Storm and Waldec Malware family.

Read more at CNet.

Conficker Stirs, updates and installs payload

Researchers were analyzing the code of the software that is being dropped onto infected computers but suspect that it is a keystroke logger or some other program designed to steal sensitive data off the machine, said David Perry, global director of security education at Trend Micro.

The software appeared to be a .sys component hiding behind a rootkit, which is software that is designed to hide the fact that a computer has been compromised, according to Trend Micro. The software is heavily encrypted, which makes code analysis difficult, the researchers said.

The worm also tries to connect to,,, and as a way to test that the computer has Internet connectivity, deletes all traces of itself in the host machine, and is set to shut down on May 3, according to the TrendLabs Malware Blog.

Newsletter Subscription

Related Tags

Newsletter Subscription
Latest News
View More News
Latest Reviews
View More Reviews
Latest Articles
View More Articles